CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-9725 — The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress...

·Source: NIST NVD

Updated:

Executive Summary

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path

Analysis

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible. CVSS Score: 9.1. Published: 2026-07-03T06:16:23.263.

Indicators of Compromise (1)

CVE (1)
CVE-2026-9725
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Signicat and TrustTech partner to bring reusable identity to European digital wallets

Signicat, the European digital identity leader and trust services provider, and TrustTech, the digital trust infrastructure company specialising in identity verification, reusable compliance checks and trusted signatures, today announced a partnership to help regulated businesses build reusable identity processes through private wallet ecosystems.

Finextra
MEDIUMVulnerabilityNEW

BetGoodwin and Trust Payments sign partnership

BetGoodwin, online sportsbook and casino, has agreed a new 8-year partnership with Trust Payments, the leading payment service provider.

Finextra
MEDIUMVulnerabilityNEW

MDOTM raises $27m for AI investment platform

MDOTM Ltd., the global provider of AI-driven investment solutions for Asset and Wealth Management companies, today announced the close of a $27 million growth equity round led by Expedition Growth Capital.

Finextra